Ansible Infrastructure

Automated deployment of proxy, hypervisors and Kubernetes nodes on Ubuntu.

Roles

Common

• Updates/upgrades packages
• Installs: curl, htop, nvim, prometheus-node-exporter
• Creates users with sudo access and hashed passwords
• Disables root user
• Configures bashrc

Hypervisor

• Installs QEMU/libvirt (libvirt-daemon-system, qemu-utils, qemu-system-x86, virtinst)
• Creates VM disks and directories
• Downloads ISOs
• Configures VM creation with virt-install

K8s-Node

• Installs k3s via official script
• Starts and enables k3s service

Proxy

• Installs nginx and configures reverse proxy sites
• Issues SSL certificates using acme.sh with Cloudflare DNS challenge
• Creates nginx configs in /etc/nginx/sites-available with TLS
• Rewrites HTTP (80) to HTTPS (443)
• Sets up systemd timers for automatic certificate renewal

DDNS

• Configures dynamic DNS for domains
• Creates update scripts per site in /opt/ddns/
• Sets up systemd timers for automatic DNS updates
• Integrates with Cloudflare API

Dependencies

• Ubuntu Server (uses apt)
• Cloudflare Account (for ACME DNS challenge and DDNS)

Usage

1. Configure inventory in inventories/production/hosts
2. Set user passwords in roles/common/vars/main.yaml (use hashed passwords)
3. Configure VMs in roles/hypervisor/vars/main.yaml
4. Configure sites in roles/proxy/vars/main.yaml (FQDN, proxy pass endpoints)
5. Configure domains in roles/ddns/vars/main.yaml (domains requiring DDNS)
6. Run deployment:

# Deploy everything
ansible-playbook --inventory inventories/production/hosts --ask-become-pass site.yml

# Deploy specific playbook
ansible-playbook --inventory inventories/production/hosts --ask-become-pass hypervisors.yml
ansible-playbook --inventory inventories/production/hosts --ask-become-pass k8s-nodes.yml

Generate Password Hash

python3 -c 'import crypt; print(crypt.crypt("your_password", crypt.mksalt(crypt.METHOD_SHA512)))'